Splunk for Cloudflare Logs: When It's Overkill
Splunk is the default SIEM in many large companies, and Cloudflare supports it as a Logpush destination. If your security team already lives in Splunk, sending Cloudflare logs there makes sense.
If you’re a startup looking for a way to keep Cloudflare history, buying a SIEM to do it is usually the wrong tool.
How Cloudflare logs get into Splunk
- Cloudflare Enterprise with Logpush enabled (Logpush is Enterprise-only)
- A Logpush job pointed at Splunk’s HTTP Event Collector (HEC), or at S3 with Splunk pulling from there
- Index configuration — which index, what retention, which fields are extracted
- Dashboards and searches, often via Cloudflare’s app for Splunk
Every step is well documented. None of it is free.
The pricing problem: you can’t look it up
Unlike Datadog, Splunk doesn’t publish list prices for most of its products. Pricing is quote-based, built on either:
- Ingest volume — how many GB per day you send, or
- Workload — the compute your searches use
Either way, Cloudflare HTTP logs are a bad fit for ingest-based pricing: high volume, low value per event. Most requests are successful, cached, and boring, right up until the one you need.
What teams actually do: filter aggressively at ingest to stay under their license. That saves money, but it deletes the history you wanted in the first place.
Hidden costs beyond the license
- Sizing and contract negotiation. You commit to a volume before you know your real usage.
- SPL expertise. Splunk’s search language is powerful but has a learning curve. Investigations need someone who knows it.
- Retention tiers. Hot searchable storage is expensive; cheaper frozen tiers need restoring before you can search them.
- Operations. Self-hosted Splunk means indexers, search heads, and upgrades. Splunk Cloud moves that work to the vendor and into the price.
When Splunk is the right tool
- You already have Splunk and a team that uses it daily
- You need Cloudflare events correlated with endpoint, identity, and network logs
- You run a SOC with detection rules and alerting on edge traffic
- You’re already on Cloudflare Enterprise
When it’s overkill
- You want history — “what happened three months ago?” — not a security operations center
- You’re not on Cloudflare Enterprise, so there are no raw logs to send
- Nobody on the team will write SPL searches
For comparison, see the published numbers in Datadog for Cloudflare logs and the do-it-yourself math in S3 + Athena.
History without a SIEM
MetricKeeper is purpose-built for one job: keeping your Cloudflare analytics history. No license sizing, no search language, no Enterprise requirement. Connect a read-only token to get started.